diff --git a/pkgs/development/libraries/libxml2/CVE-2025-6021.patch b/pkgs/development/libraries/libxml2/CVE-2025-6021.patch
deleted file mode 100644
index 7d20a17c7038..000000000000
--- a/pkgs/development/libraries/libxml2/CVE-2025-6021.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff --git a/tree.c b/tree.c
-index f097cf87..4d966ec9 100644
---- a/tree.c
-+++ b/tree.c
-@@ -47,6 +47,10 @@
- #include "private/error.h"
- #include "private/tree.h"
-
-+#ifndef SIZE_MAX
-+ #define SIZE_MAX ((size_t) -1)
-+#endif
-+
- int __xmlRegisterCallbacks = 0;
-
- /************************************************************************
-@@ -167,10 +168,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
- xmlChar *
- xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
- xmlChar *memory, int len) {
-- int lenn, lenp;
-+ size_t lenn, lenp;
- xmlChar *ret;
-
-- if (ncname == NULL) return(NULL);
-+ if ((ncname == NULL) || (len < 0)) return(NULL);
- if (prefix == NULL) return((xmlChar *) ncname);
-
- #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-@@ -181,8 +182,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
-
- lenn = strlen((char *) ncname);
- lenp = strlen((char *) prefix);
-+ if (lenn >= SIZE_MAX - lenp - 1)
-+ return(NULL);
-
-- if ((memory == NULL) || (len < lenn + lenp + 2)) {
-+ if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
- ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
- if (ret == NULL)
- return(NULL);
diff --git a/pkgs/development/libraries/libxml2/CVE-2025-6170.patch b/pkgs/development/libraries/libxml2/CVE-2025-6170.patch
deleted file mode 100644
index b66f24e305e0..000000000000
--- a/pkgs/development/libraries/libxml2/CVE-2025-6170.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-diff --git a/result/scripts/long_command b/result/scripts/long_command
-new file mode 100644
-index 000000000..e6f00708b
---- /dev/null
-+++ b/result/scripts/long_command
-@@ -0,0 +1,8 @@
-+/ > b > b > Object is a Node Set :
-+Set contains 1 nodes:
-+1 ELEMENT a:c
-+b > Unknown command This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_comm
-+b > b > Unknown command ess_currents_of_time_and_existence
-+b >
-+Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_prof
-+b >
-\ No newline at end of file
-diff --git a/debugXML.c b/debugXML.c
-index ed56b0f8..aeeea3c0 100644
---- a/debugXML.c
-+++ b/debugXML.c
-@@ -2780,6 +2780,10 @@ xmlShellPwd(xmlShellCtxtPtr ctxt ATTRIBUTE_UNUSED, char *buffer,
- return (0);
- }
-
-+#define MAX_PROMPT_SIZE 500
-+#define MAX_ARG_SIZE 400
-+#define MAX_COMMAND_SIZE 100
-+
- /**
- * xmlShell:
- * @doc: the initial document
-@@ -2795,10 +2795,10 @@ void
- xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
- FILE * output)
- {
-- char prompt[500] = "/ > ";
-+ char prompt[MAX_PROMPT_SIZE] = "/ > ";
- char *cmdline = NULL, *cur;
-- char command[100];
-- char arg[400];
-+ char command[MAX_COMMAND_SIZE];
-+ char arg[MAX_ARG_SIZE];
- int i;
- xmlShellCtxtPtr ctxt;
- xmlXPathObjectPtr list;
-@@ -2856,7 +2856,8 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
- cur++;
- i = 0;
- while ((*cur != ' ') && (*cur != '\t') &&
-- (*cur != '\n') && (*cur != '\r')) {
-+ (*cur != '\n') && (*cur != '\r') &&
-+ (i < (MAX_COMMAND_SIZE - 1))) {
- if (*cur == 0)
- break;
- command[i++] = *cur++;
-@@ -2871,7 +2872,7 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
- while ((*cur == ' ') || (*cur == '\t'))
- cur++;
- i = 0;
-- while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
-+ while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) {
- if (*cur == 0)
- break;
- arg[i++] = *cur++;
-diff --git a/xmllint.c b/xmllint.c
-index c6273477..3d90272c 100644
---- a/xmllint.c
-+++ b/xmllint.c
-@@ -724,6 +724,9 @@ xmlHTMLValidityWarning(void *ctx, const char *msg, ...)
- ************************************************************************/
- #ifdef LIBXML_DEBUG_ENABLED
- #ifdef LIBXML_XPATH_ENABLED
-+
-+#define MAX_PROMPT_SIZE 500
-+
- /**
- * xmlShellReadline:
- * @prompt: the prompt value
-@@ -754,9 +754,9 @@ xmlShellReadline(char *prompt) {
- if (prompt != NULL)
- fprintf(stdout, "%s", prompt);
- fflush(stdout);
-- if (!fgets(line_read, 500, stdin))
-+ if (!fgets(line_read, MAX_PROMPT_SIZE, stdin))
- return(NULL);
-- line_read[500] = 0;
-+ line_read[MAX_PROMPT_SIZE] = 0;
- len = strlen(line_read);
- ret = (char *) malloc(len + 1);
- if (ret != NULL) {
---
-diff --git a/test/scripts/long_command.script b/test/scripts/long_command.script
-new file mode 100644
-index 000000000..00f6df09f
---- /dev/null
-+++ b/test/scripts/long_command.script
-@@ -0,0 +1,6 @@
-+cd a/b
-+set
-+xpath //*[namespace-uri()="foo"]
-+This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_command_please_dont_crash foo
-+set Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_profound_emotion_and_every_grand_aspiration_that_propels_our_species_ever_onward_through_the_relentless_currents_of_time_and_existence
-+save -
-diff --git a/test/scripts/long_command.xml b/test/scripts/long_command.xml
-new file mode 100644
-index 000000000..1ba44016e
---- /dev/null
-+++ b/test/scripts/long_command.xml
-@@ -0,0 +1 @@
-+
---
-GitLab
-
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 41d2b1f953f0..c459aafa171f 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -8,33 +8,15 @@
let
packages = {
libxml2_13 = callPackage ./common.nix {
- version = "2.13.8";
+ version = "2.13.9";
src = fetchFromGitLab {
domain = "gitlab.gnome.org";
owner = "GNOME";
repo = "libxml2";
tag = "v${packages.libxml2_13.version}";
- hash = "sha256-acemyYs1yRSTSLH7YCGxnQzrEDm8YPTK4HtisC36LsY=";
+ hash = "sha256-1qrgoMu702MglErNH9N2eCWFqxQnNHepR13m53GJb58=";
};
extraPatches = [
- # same as upstream patch but fixed conflict and added required import:
- # https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0.diff
- ./CVE-2025-6021.patch
- (fetchpatch {
- name = "CVE-2025-49794-49796.patch";
- url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/f7ebc65f05bffded58d1e1b2138eb124c2e44f21.patch";
- hash = "sha256-p5Vc/lkakHKsxuFNnCQtFczjqFJBeLnCwIwv2GnrQco=";
- })
- (fetchpatch {
- name = "CVE-2025-49795.patch";
- url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c24909ba2601848825b49a60f988222da3019667.patch";
- hash = "sha256-vICVSb+X89TTE4QY92/v/6fRk77Hy9vzEWWsADHqMlk=";
- excludes = [ "runtest.c" ]; # tests were rewritten in C and are on schematron for 2.13.x, meaning this does not apply
- })
- # same as upstream, fixed conflicts
- # https://gitlab.gnome.org/GNOME/libxml2/-/commit/c340e419505cf4bf1d9ed7019a87cc00ec200434
- ./CVE-2025-6170.patch
-
# Unmerged ABI-breaking patch required to fix the following security issues:
# - https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
# - https://gitlab.gnome.org/GNOME/libxslt/-/issues/140